Privacy Policy

1. Data controller

The controller of personal data within the meaning of Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) and the operator of the Můj Výkaz service (the “Service”) is:

The controller has not appointed a data protection officer, as its activities do not fall under the mandatory appointment under Art. 37(1) GDPR. Please send questions and requests concerning the processing of personal data to the contact e-mail above — we handle them without undue delay and within 30 days at the latest (Art. 12(3) GDPR).

2. What data we process

2.1 Data we process as a controller

• Account and login: name, e-mail, phone number (optional, only so that we can contact you), password hash, two-factor authentication settings, sessions, login records (IP address, browser)
• Customer and subscription billing: company name, company ID (IČO), VAT ID (DIČ), address, contact details and payment data processed by the Stripe payment gateway
• Communication with us: messages to support, feedback from the application, e-mails; a call-back request from the application (name, phone, company, when it suits you, topic and note — we pre-fill the details from your account and you can change them) and our notes from calls, meetings and e-mails with you (what you needed, what we agreed, when to get back to you). The notes are visible only to the operator of the Service, not to members of the organization
• Website mujvykaz.cz: data from cookies and traffic measurement (section 8), demo bookings
• Technical data: IP address, browser type, technical logs and error records, push notification subscription (if you turn notifications on)
• Weather on the dashboard: the cities you save for the weather. When you use “My location”, your browser, with your permission, sends us your location rounded to about one kilometer; we convert it to the name of the municipality and store only that — we do not store the coordinates
• Registration origin: where you came to the registration from (for example a search engine, a link on our website or a campaign), optional answers from the post-registration wizard (how you heard about us, what you want to solve in your company) and an optional reason if you cancel your organization
• Questions in the support chat: the text of the question (at most 300 characters) and the age of the account, so that we can improve the help; we do not store entire conversations
• Preparing for a call with you: when we are about to call you (manually, not for every registration), we may have a short brief about your company prepared. It is based on the data we keep about the organization — name, company ID (IČO), country and city, the domain of the company e-mail address (not the full address; we do not use it for Gmail and similar mailboxes), registration origin, answers from the wizard, plan and aggregate figures on the use of the application (for example the number of active people and time entries, modules in use), not the content you enter into the application —, on the ARES register (legal form, date of establishment, field of business, employee count range, VAT payer status) and on publicly available information about the company on the internet, mainly from its website. We search the internet only for a company that the ARES register confirms as a legal entity; for a self-employed natural person, we read at most their own business website. As regards people, the brief states at most the name and work role published by the company or a public register (for example the managing director). We do not search for private information (family, place of residence, assets, health, opinions) and such information does not belong in the brief; social networks (LinkedIn, Facebook, Instagram, X, TikTok, Threads) are excluded from the search. Sources are listed in the brief as links.
• Booked call: when you book a call with us through Cal.com, Cal.com sends us your name, e-mail, the time of the call, the meeting link, the note you wrote in the form and, if you cancel, the reason for cancelling. We store them so that we do not miss the call and can prepare for it. Based on the e-mail address, we match the booking to your account and to the organization in which you are an active member; for a company address (not Gmail, Seznam and similar mailboxes) also to the organization whose owner has an e-mail address on the same domain. The booking is visible only to the operator of the Service, not to members of the organization.

2.2 Data we process as a processor for organizations

Data that an organization and its members enter into the application belong to the organization — the organization is their controller and it is the organization that provides you with information about them (typically your employer). We process them only on its instructions and in accordance with the Data Processing Agreement, which contains a detailed overview. This mainly includes:

• Member data: name, e-mail, phone number, position; date of birth and start date, if the organization enters them
• Work records: hours worked, descriptions of activities, projects, tasks, work plan, absences, billing data
• Financial data about members: rates, hourly and monthly costs, bonuses — visible only to the roles that the application allows to see them
• Communication and files: messages, comments and attachments in the application, questions in AI Reports
• Google Calendar data (optional):if you connect your Google account in the application (Settings → Calendar & AI assistants), the application reads the titles and times of events from your primary calendar (for suggested work entries in the Timesheet and in the My day overview) and writes all-day events for approved absences into your primary calendar. If a colleague, in their absence request, selects you as someone to be informed, their absence is also written into your primary calendar after approval (as a private all-day event without the note); you can turn this off in the application. We do not store the content of events in the database; we store only event IDs (see 10.4). Details are in section 10 “Google API Services”.
• Expense documents (optional): files of invoices and receipts that you upload into the Service and the data read from them (supplier, company ID (IČO), VAT ID (DIČ), document number, dates, amounts, description). A document may contain personal data of the supplier — a self-employed natural person — or of persons named on the receipt.

3. Purposes and legal basis

We process the data for which we are responsible as a controller as follows:

• Account of the founder of an organization and subscription billing — performance of a contract [Art. 6(1)(b) GDPR]
• Account of an invited member, login and security (protection against misuse, login records, technical logs) — legitimate interest in the secure operation of the Service [Art. 6(1)(f) GDPR]
• Tax documents for the subscription — legal obligation [Art. 6(1)(c) GDPR]
• System e-mails (invitations, password reset, notifications you set up in the application) — performance of a contract; for invited members, legitimate interest
• Reminder of an incomplete registration: if, after registering, you do not verify your e-mail or do not create an organization, we will send you at most one reminder for each of these two steps, without offers — legitimate interest in enabling you to complete the registration you started [Art. 6(1)(f) GDPR]. We delete an account for which no organization has been created 30 days after registration.
• Tips and offers about the Service: during the trial period and shortly after it, we send you several e-mails with tips on using the Service and an offer of a paid plan — legitimate interest [Art. 6(1)(f) GDPR] and Section 7(3) of Act No. 480/2004 Coll. We choose which tip to send you according to how far your organization has progressed in the application (for example whether it already has its first time entry or cost center recorded, how many members it has and whether you track time yourselves). You can unsubscribe from these e-mails at any time using the link in each of them.
• Support chat in the application — legitimate interest in providing help with using the Service
• Weather on the dashboard (forecast for the place you choose; we determine the municipality from your location only after you click “My location” and give your permission in the browser) — performance of a contract [Art. 6(1)(b) GDPR]
• Improving the Service — evaluating where new customers come from, what they expect from the Service and why they may leave (registration origin, answers from the wizard, cancellation reason, questions in the support chat) — legitimate interest [Art. 6(1)(f) GDPR]
• Preparing for a call with you (the brief described in 2.1) — legitimate interest in being able to offer you help during the call and, where appropriate, a plan suited to your company [Art. 6(1)(f) GDPR]. The brief is visible only to the operator of the Service, not to other members of the organization; the owner of the organization receives it in the personal data export. You can object to this processing at any time by e-mail — we will delete the brief and will not prepare another one.
• Offering help based on usage: in the first weeks after registration the application alerts us to a new organization that is struggling to get started — for example when, after its first full working day, it has no time entry of its own, or when it stops recording. We may then offer you help by phone or e-mail. We evaluate only aggregate usage data (the number of time entries and of people recording, the date of the last entry), not the content of the entries — legitimate interest in helping you get the Service running [Art. 6(1)(f) GDPR]. You can object to this at any time by e-mail; an organization can opt out of customer care as a whole (point 1.7 of the Data Processing Agreement). We do not send these alerts for one-person organizations (the “Just me” option) or internal organizations.
• Call-back request and notes from our communication with you (as described in 2.1) — we handle the request as steps taken at your request prior to entering into a contract, for customers as performance of the contract [Art. 6(1)(b) GDPR]; we keep notes from calls and meetings based on our legitimate interest in knowing what we agreed with you [Art. 6(1)(f) GDPR]. Call-back requests are included in the export of your personal data; we provide the notes on request.
• Booked call (as described in 2.1) — steps taken at your request prior to entering into a contract, for customers performance of the contract [Art. 6(1)(b) GDPR]; matching the booking to an account and organization — legitimate interest in knowing whom we are talking to during the call [Art. 6(1)(f) GDPR]
• Cookies and website measurement, demo bookings — according to section 8 (consent or legitimate interest, as the case may be)

We process data processed for organizations (2.2) for the purposes determined by the organization: recording and approving work, absences, planning, invoicing, profitability, AI Reports and reading expense documents (an expense is created only after you check and save the data; we verify suppliers in the ARES register). The legal basis is determined by the organization as the controller.

Providing your name and e-mail is a contractual requirement for creating an account; without them, an account cannot be created. We evaluate some data automatically: we select tips according to the state of the organization, the application alerts us to an organization that is struggling to get started, and before a call we may have a brief about the company prepared. This is profiling within the meaning of Art. 4(4) GDPR, to which you can object (Art. 21). We do not make decisions based solely on automated processing that would produce legal or similarly significant effects for you (Art. 22 GDPR). A human decides on contacting you by phone and on any offer made during a call; tips by e-mail are selected automatically and have no such effects.

4. Who processes your data on our behalf

To operate the Service, we use the processors listed in section 5. For support and development, we use an AI coding assistant (Anthropic). As long as we do not use it under commercial terms with a data processing agreement, it does not receive your personal data — only code, technical records without personal data, and aggregate figures.

5. Recipients of data

Your data may be shared with the following third parties:

We have concluded data processing agreements under Art. 28 GDPR with all processors. The current list of processors of the data that organizations enter into the application is in the Data Processing Agreement and on the Security page.

6. Retention period

7. Your rights

As a data subject, you have the following rights under the GDPR:

• Right of access (Art. 15) — to obtain a copy of your personal data
• Right to rectification (Art. 16) — to have inaccurate data corrected
• Right to erasure (Art. 17) — to request deletion of your account and data
• Right to data portability (Art. 20) — to export your data in a machine-readable format
• Right to restriction of processing (Art. 18)
• Right to object (Art. 21) — to processing based on legitimate interest, including the sending of tips and offers
• Right to withdraw consent — where processing is based on consent (cookies, demo bookings), you can withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal
• Right to lodge a complaint — with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), www.uoou.cz

8. Cookies and tracking technologies

On the mujvykaz.cz website, we use three categories of cookies and similar technologies; the app.mujvykaz.cz application uses only strictly necessary ones. For the “Analytics” (“Analytické”) and “Marketing” (“Marketingové”) categories, we require your prior consent under Section 89(3) of Act No. 127/2005 Coll. and Art. 6(1)(a) GDPR. You can change your settings at any time using the button below.

8.1 Strictly necessary cookies

Required for the Service to function (login, user preferences). Legal basis: legitimate interest [Art. 6(1)(f) GDPR] — under Section 89(3) of Act No. 127/2005 Coll., consent is not required.

8.2 Analytics measurement — Plausible Analytics

To understand website traffic, we use Plausible Analytics running on our own server in the European Union (analytics.mujvykaz.cz). Plausible does not store any cookies or data in the browser, does not create persistent visitor identifiers and does not transfer data to third parties outside the EU. Legal basis: legitimate interest [Art. 6(1)(f) GDPR] — anonymized traffic measurement. Plausible measurement runs regardless of your cookie consent choice.

8.3 Analytics cookies — Google Analytics 4

If you give your consent, we also activate Google Analytics 4 for a more detailed analysis of visitor behavior. Google Analytics uses cookies to identify unique visitors and sessions. Legal basis: your consent [Art. 6(1)(a) GDPR]. Provider: Google Ireland Limited; data may be transferred to Google LLC (USA) — EU–US Data Privacy Framework. Google Analytics loads only if you consent to analytics cookies.

8.4 Marketing cookies — Google Ads

If you consent to marketing cookies, we activate measurement of ad effectiveness in Google Ads (conversion tracking, remarketing). Legal basis: your consent [Art. 6(1)(a) GDPR]. Provider: Google Ireland Limited; data may be transferred to Google LLC (USA) — EU–US Data Privacy Framework.

8.5 Google Consent Mode v2

We use Google Consent Mode v2 in basic mode: until you consent to analytics or marketing cookies, the Google Analytics and Google Ads scripts are not loaded on the page at all and Google receives no data from you. Once you give consent, full measurement with cookies is activated as described in the tables above.

8.6 How to withdraw consent

You can withdraw your consent at any time by clicking the “Nastavení cookies” (Cookie settings) button in the website footer or the button above in this section. Withdrawing consent does not affect the lawfulness of processing before its withdrawal. Alternatively, you can delete GA4 and Google Ads cookies directly in your browser settings.

8.7 Cal.com — booking system

For booking demo meetings, we use the Cal.com service (Cal.com, Inc., Delaware, USA), embedded as an iframe on the /contact page and in a pop-up window on the home page; the application and the e-mails sent after registration contain a link to it. Cal.com acts as an independent controller (or as a processor, depending on the type of data concerned) for the data you enter in the form (name, e-mail, company, optional answers). Cal.com sends us a copy of the booking (name, e-mail, time, meeting link, note and any reason for cancelling), which we process as a controller as described in sections 2.1, 3 and 6.

Legal basis: your consent expressed by booking a meeting [Art. 6(1)(a) GDPR], or steps taken prior to entering into a contract [Art. 6(1)(b) GDPR].

Transfer to the USA: Cal.com processes data in the USA. Protection is ensured by standard contractual clauses (SCC) under Art. 46 GDPR and by certification under the EU–US Data Privacy Framework. Details can be found in the Cal.com Privacy Policy.

When Cal.com loads: the booking calendar loads only after you click “Domluvit demo” (Book a demo) or “Zobrazit kalendář” (Show calendar) on the website, or the link to a short introduction in the application or in the e-mail after registration. That link opens a Cal.com page and does not contain your name, e-mail or any other data. Cal.com does, however, see your IP address and browser data and may store its own cookies for the booking functionality and spam prevention (managed by Cal.com, not by Můj Výkaz). It receives the data from the form only once you submit the booking.

9. Security

We take appropriate technical and organizational measures to protect your data:

10. Google API Services — additional provisions

If you connect your Google account in the application (Settings → Calendar & AI assistants) for the Google Calendar integration, Můj Výkaz accesses your Google Calendar data in accordance with the Google API Services User Data Policy, including the Limited Use requirements.

10.1 Permissions used (OAuth scopes)

The application requests a single permission from Google: https://www.googleapis.com/auth/calendar.events.owned — viewing, creating, changing and deleting events in calendars that you own. We use it only in your primary calendar and only for two things:

• reading the titles and times of events for suggested work entries (the option to create a work entry from an existing meeting),
• creating and deleting all-day events for approved absence requests (vacation, sick leave, home office) from the Absences module — your own and those of colleagues who selected you to be informed in their request (see 10.2).

We do not read shared or other calendars and do not write to them. Users who connected their calendar before 6 October 2026 granted the broader permission .../auth/calendar.events; the application uses it in the same way — only in your primary calendar and for the same two purposes.

Sign in with Google (optional and separate from the calendar connection): if you sign in to Můj Výkaz with your Google account, we receive only basic profile information from Google — your name, e-mail address and profile picture (scopes openid, email and profile). We use it only to sign you in and to maintain your account. Together with your Google account identifier we store the sign-in tokens issued by Google and use them for nothing else. Signing in does not give us access to your calendar or any other Google data. Sections 10.2 to 10.5 apply to the Google Calendar connection.

10.2 How we use Google data

• Reading:We load the titles, times and locations of events from your primary calendar in real time when you open the Timesheet, the My day overview or the Today's meetings widget on the dashboard (the location is shown only in the widget). From your response to an invitation we can tell which meetings you declined, and we do not suggest those. We display events as suggestions with a “Track” button for quickly creating a work entry. We do not store the content of events in our database. When you yourself create a work entry from a suggestion, the title and duration of the meeting are pre-filled into it, and we store the event ID with the entry so that the same meeting is not suggested again.
• Writing: When an absence request is approved, we create an all-day event in your primary calendar with an identifying title (e.g. “Vacation — Jan Novák”). We store the ID of the created event together with the absence record so that we can automatically delete the event when the request is cancelled or rejected.
• Colleagues’ absences in your calendar: when a colleague, in their absence request, selects you as someone to be informed, then after the request is approved we also create an all-day event (e.g. “Vacation — Jana Nováková”) in your primary calendar, using your own connection — that is, only if you have connected Google Calendar in the application yourself. The event is marked as private and free, has no reminders and no note from the request, and no invitation is sent to anyone. A non-public absence type (e.g. illness) is shown in it only as “Absence”. When the absence is cancelled or shortened, we automatically delete or replace the event (only its ID is stored). You can turn off this writing at any time in Settings → Calendar & AI assistants → Google Calendar (“Add the time off of colleagues who picked me”) without having to disconnect the whole calendar; you can also delete the event yourself. In doing so, we do not read anything additional from your calendar.

10.3 Limited Use — what we do NOT do with Google data

In accordance with the requirements of the Google API Services User Data Policy — Limited Use, we expressly declare that:

• We do not use Google user data to train artificial intelligence models or any generalized models.
• We do not use Google user data for targeted advertising.
• We do not resell Google user data or provide it to third parties for commercial purposes.
• We do not shareGoogle user data with third parties beyond what is necessary to provide the feature you have explicitly requested (e.g. displaying suggestions in the timesheet). The title and duration of a meeting that you yourself save in a work entry become part of your organization's data and are visible to authorized members of your organization (e.g. in timesheets and reports).
• We do not transfer Google user data to advertising platforms, data brokers or other information resellers.
• We do not use Google user data to determine creditworthiness or for lending purposes.
• We do not modify or delete any events other than those we created ourselves from the Absences module. For other events, we only read titles and times for suggestions (see 10.2).
• We do not write to shared, team or secondary calendars — only to the user’s own primary calendar.
• No humans (including employees of Můj Výkaz) read your Google data, except where: (a) you have given us your explicit consent to do so, (b) it is necessary for security purposes (e.g. investigating a bug or abuse), (c) it is required by law, or (d) the data are aggregated and anonymized for internal analysis purposes.

10.4 Token storage and retention

• Your Google refresh token is stored encrypted (AES-256-GCM) in the user profile in our database on a server in Germany (Hetzner Cloud).
• Access tokens are temporary (valid for 1 hour) and are held only in server memory; they are not stored in the database.
• Event contentfrom your calendar (reading): we do not store it — we load it from the Google API each time it is displayed and discard it after display. The exception is the title and duration of a meeting that you yourself save in a work entry (see 10.2); the work entry then becomes part of your organization's data.
• The e-mail address of the connected Google account (shown as “Connected as …”) is stored with the connection so that you know which account is connected; it is deleted when you disconnect.
• Event IDs: for an absence request, and for a colleague in whose calendar we have written it, we store the ID of the created event (column google_calendar_event_id in the tables absence_requests and absence_notify_recipients), so that we can delete or replace the event when the absence is cancelled or shortened. For a work entry created from a suggestion, we store the ID of the event it was created from (table time_entries).
• When you disconnect the integration(Settings → Calendar & AI assistants → Google Calendar → Disconnect), the refresh token is immediately deleted from our database.
• When you delete your account, all related data (token, event IDs) are anonymized or deleted within 30 days, as described in section 6.

10.5 How to revoke the permission

You can revoke access to Google Calendar at any time in two ways:

• In the Můj Výkaz application:Settings → Calendar & AI assistants → Google Calendar → the “Disconnect” button. This immediately deletes the refresh token from our database.
• Directly in your Google account: myaccount.google.com/permissions — this revokes access on Google’s side. Existing events that Můj Výkaz has already written to the calendar remain there; no new synchronization will take place.

11. Changes to this policy

We may update this policy from time to time. We will inform you about material changes by e-mail or by a notice in the application. The date of the last update is stated at the beginning of the document.